CWE-346

686 vulnerabilities with CWE-346

CVE-2025-34291 HIGH KEV

Langflow <= 1.6.9 - Account Takeover and Remote Code Execution via CORS Misconfiguration

CVSS 8.8

CVE-2025-8074 MEDIUM

Synology BeeDrive < 1.4.3-13973 - Arbitrary File Write via Origin Validation Error

CVSS 5.6

CVE-2025-13947 HIGH

WebKitGTK < 2.50.3 - Information Disclosure via File Drag-and-Drop Origin Validation Error

CVSS 7.4

CVE-2025-37734 MEDIUM

Kibana Observability AI Assistant - Forged Origin Server-Side Request Forgery

CVSS 4.3

CVE-2025-12905 MEDIUM

Google Chrome <140.0.7339.80 - CSRF

CVSS 5.4

CVE-2025-12245 MEDIUM

chatwoot < 4.7.0 - Origin Validation Error in Widget IFrame Helper

CVSS 5.3

CVE-2025-62250 MEDIUM

Liferay Digital Experience Platform < 7.3 - Improper Authentication via Unauthenticated Cluster Messages

CVSS 6.5

CVE-2025-62584 HIGH

Whale < 4.33.325.17 - Same-Origin Policy Bypass in Dual-Tab Environment

CVSS 7.5

CVE-2025-9265 CRITICAL

Kiloview NDI N30 < 2.02.246 - Unauthenticated Broken Authorization

CVE-2025-2140 MEDIUM

IBM Engineering Requirements Management Doors Next <7.1 - Auth Bypass

CVSS 5.7

CVE-2025-59957 MEDIUM

Juniper Junos < 21.4R3 - Unauthenticated Backdoor Creation via Physical Access

CVSS 6.8

CVE-2025-42706 MEDIUM

Falcon sensor <7.24 - Privilege Escalation

CVSS 6.5

CVE-2025-59159 CRITICAL

SillyTavern < 1.13.4 - DNS Rebinding via Host Whitelist Bypass

CVSS 9.6

CVE-2025-11304 MEDIUM

CodeCanyon/ui-lib Mentor LMS <1.1.1 - XSS

CVSS 6.3

CVE-2025-59845 HIGH

Apollo Sandbox < 2.7.2 & Apollo Explorer < 3.7.3 - CSRF via window.postMessage Origin Validation Error

CVSS 8.2

CVE-2025-20364 MEDIUM

Cisco Aironet IOS XE Controller - Unauthenticated 802.11 Action Frame Injection

CVSS 4.3

CVE-2025-56648 MEDIUM

parcel < 1.10.3 - Origin Validation Error via XMLHTTPRequest

CVSS 6.5

CVE-2025-10193 HIGH

Neo4j Cypher MCP server 0.2.2-0.3.0 - DNS Rebinding Attack via Same-Origin Policy Bypass

CVE-2025-10201 HIGH

Google Chrome < 140.0.7339.127 - Site Isolation Bypass via Mojo

CVSS 8.8

CVE-2025-9636 HIGH

pgAdmin <= 9.7 - Cross-Origin Opener Policy Bypass via OAuth Flow Manipulation

CVSS 7.9

CVE-2025-47909 HIGH

gorilla/csrf < 1.7.3 - Origin Validation Error in TrustedOrigins

CVSS 7.3

CVE-2025-51605 HIGH

Shopizer 3.2.7 - Origin Validation Error in CORS Implementation

CVSS 8.1

CVE-2025-9180 HIGH

Firefox and Thunderbird - Same-Origin Policy Bypass in Canvas2D

CVSS 8.1

CVE-2025-52621 MEDIUM

HCL BigFix SaaS < 8.1.14 - Cache Poisoning via Origin Header Reflection

CVSS 5.3

CVE-2025-8881 MEDIUM

Google Chrome < 139.0.7258.127 - Cross-Origin Data Leak via File Picker

CVSS 6.5